Phorge and Phabricator Need a Migration-Aware Exposure Review

Phorge and Phabricator Need a Migration-Aware Exposure Review Phorge is a maintained fork of Phabricator, and many installations still carry the older product name in their page titles. A search that looks only for the new name can miss the installed base. A search that looks only for the old name can include historical references that are no longer running the software. On 2026-11-11, a count-only search for title="Phabricator" returned 244 matches at 08:46:29 +08:00. A separate query for title="Phorge" returned 34 matches at 08:46:28 +08:00. Both used page 1, page size 1, and sub_type=all. The links are the Phabricator title query and the Phorge title query. These are title observations, not an installation census. A migrated instance may retain the old title, a custom theme may remove both strings, and a public page can mention either name without exposing an application. The two counts should be treated as overlapping candidate sets until a host is verified. The control plane is the target Phorge's HTTP API uses bearer-token authentication. The documentation describes the API as a request, response, and error surface for repository and application operations. A token is an identity with the permissions of its associated account or application. The important review question is not whether a login page is visible, but which token can perform which action. Inventory the accounts that can create tokens, the scopes or policies attached to those tokens, and the applications they can reach. Review repository hosting, differential revisions, repository automation, and administrative tools separately. A developer who needs to read a repository should not inherit the authority to change global policy or manage authentication providers. Phorge documentation also treats authentication providers and account registration as configuration that can lock an administrator out. That makes provider changes a high-impact operational action. A public login page may be intended for developers, while an open registration flow may allow an outsider to create an account. Verify the registration policy, the allowed identity providers, and the approval path for new accounts. Compare names without merging identities Use both title queries as discovery hints, then confirm the product on the host. A page title can be copied by a documentation mirror or an archived ticket. A strong verification should include a product-specific response, a trusted administrative page, or an authenticated API identity response. Do not add the two counts. They can overlap, and a match in each query may describe the same deployment. Do not call the difference a migration rate. It is only a difference between two search strings at one point in time. For each confirmed instance, ask: Is it Phorge or the older Phabricator distribution? Is the public surface limited to login and public repository pages? Are API tokens short-lived, owned, and scoped to a specific application? Are repository hooks, workers, and mail integrations using separate identities? Can a user create an account without an invitation or provider approval? Test the authorization path A practical test uses two accounts: an ordinary project member and an administrative test account. Confirm that the ordinary account can read the repository and edit the objects it needs, then confirm that it cannot change provider configuration, global policy, or another user's token. Test a request with a token that belongs to the wrong account and confirm that the API rejects it rather than returning a filtered result that still reveals data. Review the token lifecycle. A token that remains valid after an account is disabled is a stale authority. A token created for a migration that stays active afterward is a temporary decision that became permanent. Keep a record of token owner, purpose, creation time, and revocation condition. The defensible conclusion Phorge and Phabricator are one migration-aware inventory problem. The old title has the larger observed count, but the new title is the only one that directly names the current product. Use both to find candidates, then rely on authenticated product evidence. The useful outcome is a small list of confirmed installations, each with a stated provider policy, token inventory, and repository authority boundary. A count of 244 legacy titles and 34 current titles is context for search coverage. It is not a vulnerability finding. References Phorge HTTP API Phorge documentation Phorge authentication providers ZoomEye Phabricator title query ZoomEye Phorge title query